[enhancement] Add credentials: 'include' toggle to connection settings #1454

Feature Request: Add credentials: 'include' toggle to connection settings

Summary

Add a UI toggle (e.g., a checkbox in the connection settings panel) that sets credentials: 'include' on the fetch calls made by the Streamable HTTP (direct) transport. When enabled, the browser will automatically attach cookies stored for the target domain to every MCP request.

Problem

The browser treats Cookie as a forbidden header — JavaScript cannot set it manually. The only standards-compliant way to have the browser send cookies on a cross-origin request is to use credentials: 'include' in the fetch call.

The stock MCP Inspector does not set this option, so any MCP server that relies on cookie-based authentication or session routing (e.g., a server that reads a session cookie to resolve the correct backend environment) is unreachable from the inspector UI without a post-build patch to the browser bundle.

Workaround (current state)

Users and operators must patch the compiled browser bundle after installation to inject credentials: 'include' into the two fetch call sites used by the direct Streamable HTTP transport:

// Before patch
fetch(url2, {
  ...init,
  headers: requestHeaders
});

// After patch
fetch(url2, {
  ...init,
  credentials: "include",
  headers: requestHeaders
});

This is a fragile, build-time workaround that breaks whenever the inspector is updated, requires custom Docker image tooling to maintain, and is invisible to end users.

Proposed Solution

Add a "Send cookies (credentials: include)" checkbox to the connection settings UI, alongside existing transport options.

• Default: off (preserves current behaviour; no breaking change)
• When enabled: passes credentials: 'include' in the fetch options for direct Streamable HTTP requests
• Scope: applies only to the direct transport; the proxy transport is unaffected (it forwards cookies server-side via its own mechanism)

Server-side requirements (informational)

For credentials: 'include' to work end-to-end, the target server must respond with:

• Access-Control-Allow-Origin: <exact origin> — wildcards (*) cause credentials to be silently ignored by the browser
• Access-Control-Allow-Credentials: true

Additionally, because the inspector and the MCP server run on different origins, any cookies the server expects to receive must be set with SameSite=None; Secure. Browsers silently block cross-site cookies that use the default SameSite=Lax (or Strict) policy, regardless of the credentials: 'include' setting.

These are server responsibilities, but a note in the UI tooltip or docs would help users diagnose misconfigured servers.

Why this belongs in the inspector

Cookie-based auth is a common, legitimate pattern for internal tools, dev environments, and enterprise MCP deployments. The Fetch API provides credentials: 'include' specifically for this use case, and the browser enforces it correctly when paired with proper CORS headers on the server. Exposing this as a UI option is a small, non-breaking change that eliminates the need for downstream consumers to patch the inspector bundle.

Acceptance Criteria

• A toggle/checkbox is present in the connection settings UI for the Streamable HTTP transport
• When the toggle is off, fetch behaviour is unchanged from today
• When the toggle is on, credentials: 'include' is passed to both direct-connection fetch call sites
• The toggle state persists across sessions (e.g., via localStorage) consistent with how other connection settings are persisted
• A tooltip or inline note explains that the target server must set Access-Control-Allow-Credentials: true and a non-wildcard Access-Control-Allow-Origin